Dashboards & Visualizations

Splunk panel refresh in background or don't clear the panel before refreshing?

lazyfai
Explorer

My splunk dashboard has ~60 panels based on a few (~5) base searches and a post processing for each panel.

Whenever the base search is refreshed, the content like the bars, lines, figures in all dependent panels got clear out and wait for data, which may take > 10s, the panel content will then show up after > 10s of blank panel, can this behavior change in configuration or coding?

TylerP
Observer

Was there answer for this one? I'm experiencing a similar issue. 

0 Karma

lazyfai
Explorer

demo video https://youtu.be/qSI_4uMYDxY
A demo video showing the issue. I have 4 base searches queries for 4 time series data, and in each orange square there are 4 post process queries to filter out the related application (name on top left corner)
Every time the base search token changed, all graphs show waiting for data instead of update the graph after search.

0 Karma

chinmoya
Communicator

Are all your 60 panels visible at one single instance?

0 Karma

lazyfai
Explorer

Yes, but it is not about the number of panels, but the behavior of panel updating. Whenever a search token changes, the lines / bars / pies will firstly disappeared, then run the search, and re-draw after the result arrive.
Is there any method to DON'T clear the lines / bars / pies until the new set of data is ready, and just redraw the data instead of showing "waiting for data"?

Edit: For example, Grafana's visualization will show a spinner at the corner of the panel while keeping the content, then refresh the content with the new data, instead of clear the panel.

0 Karma

Sukisen1981
Champion

@lazyfai - tried tinkering with the panel settings for the dependent ones?
edit the search query in the panel and choose refresh indicator as none ?

0 Karma

lazyfai
Explorer

@Sukisen1981 No luck, it seemed to be related to token.
I use a token (which change over time, eg. per few minutes) in the base search, and then another token in post process. Whenever the token in base search changed, all dependent panels display "search cancelled" and then "waiting for data" and finally show the data.
What I want is that the panel should keep the data until the new data is ready, and refresh the panel, instead of firstly clear the display and "waiting for data".

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...